An urgent message that appears to be from your supervisor or a director asking whether you wouldn’t mind just paying a bill or purchasing something for the company. This scam, also known as CEO fraud, is one frequently encountered by UM staff. “Usually they’re asked to buy gift cards for websites such as Amazon, ostensibly to give to, for example, new students,” says Jules Silvertand of the Corporate Information Office, responsible for digital security policy at Maastricht University. “It’s more targeted than a ‘general’ scam email that is sent to lots of people at the same time. The scammers do their research, for example, by looking into who would be the likely supervisor for a particular employee, and maintain some email contact before asking for money.”
Tricked
This type of fraud is not new, but UM has recently seen an uptick in the number of attempts. “Usually, it’s a handful a month, but now we sometimes get four a week,” says Silvertand. Often without effect: many emails are automatically labelled as spam, and the messages that do get through are usually caught by staff members who realise early on that something isn’t right. But someone was tricked recently. “As far as we know, it’s the first time this year, to the tune of several thousand euros. That money is gone forever. However, we really consider someone like that a victim, not as especially naive. It’s often the most dedicated people who get scammed, those who jump to do what their bosses ask them to.”
How do we avoid falling into the trap? First of all, check the sender’s email address, advises Silvertand. “Make sure it ends in @maastrichtuniversity.nl. If it doesn’t and instead is a Gmail account, for example, use your boss’s actual email address to answer. If you’re unsure, you can always contact your boss through a different channel, such as calling them. Or ask a colleague to double check.”
Over-alert
Above all, always report suspicious emails to the ICTS service desk. “Even if it’s clearly a scam. These people are always coming up with new emails and we can use them to refine the spam filters for our mail systems.” This also applies to other forms of fraud or phishing (digitally fishing for sensitive data). “Be careful with messages that say a colleague would like to share files through a platform such as OneDrive or SharePoint, especially if that person has never shared files like that with you before.”
When in doubt, ICTS can check whether the email is a scam or a legitimate email. “That happens a few times a month, too,” says Silvertand. People are often wary of ‘real’ emails from DocuSign, which is used to sign important documents such as contracts. “Some people are over-alert. Not surprising really, as it can be hard to distinguish between real and a scam. It’s better to be safe than sorry.”
Deepfakes
And finally, do we need to be afraid of fake phone calls or video calls, in addition to fake emails from our bosses? Thanks to AI technology, it is getting easier and easier to create so-called deepfakes, where a scammer looks and sounds like a different person. There have already been a number of cases of deepfake fraud involving large international companies. “We’ve never seen anything like that at the university,” says Silvertand. “But we are keeping a close eye on developments.”